Target Policy

Structured Scope

• Asset Identifier

  Asset Type

  Max Severity

• api.yoti.com

  URL

  critical
• frankd.yoti.com

  URL

  critical
• https://api.yoti.com

  URL

  critical
• https://frankd.yoti.com

  URL

  critical
• https://core.yoti.com

  URL

  critical
• https://ccloud.yoti.com

  URL

  critical
• https://code.yoti.com

  URL

  critical
• https://www.yotisign.com

  URL

  critical
• 983980808

  ---

  https://itunes.apple.com/us/app/yoti/id983980808

  APPLE_STORE_APP_ID

  critical
• www.yoti.com

  ---

  Please DO NOT report items from this website, unless you deem them to be critical in nature. WPSCAN findings will not be accepted.

  URL

  none
• Yoti liveness detection campaign

  OTHER

  none
• ccloud.yoti.com

  URL

  critical
• Yoti Password Manager browser extension

  ---

  https://chromewebstore.google.com/detail/yoti-password-manager/ajgehecfkfhindkhdcjmifbngkfdflla

  OTHER

  critical
• www.yotisign.com

  ---

  You must use "[Hackerone] ORG_NAME" when registering an organisation!

  URL

  critical
• com.yoti.mobile.android.live

  ---

  https://play.google.com/store/apps/details?id=com.yoti.mobile.android.live

  GOOGLE_PLAY_APP_ID

  critical
• core.yoti.com

  URL

  critical
• code.yoti.com

  URL

  critical
• identity.yoti.com

  URL

  critical
• hub.yoti.com

  ---

  you must use "[Hackerone] <whatever name here>" when creating any organisation/application/service within Hub!

  URL

  critical
• developers.yoti.com

  ---

  Please DO NOT test this domain - it is a third party hosted documentation site for developers, and not of concern to us. The third-party service DO NOT want this site tested. Thank you!

  URL

  none

Target Scope Domains

• api.yoti.com
• ccloud.yoti.com
• code.yoti.com
• core.yoti.com
• frankd.yoti.com
• hub.yoti.com
• identity.yoti.com
• www.yotisign.com

• 21 Subdomains
• 411 Endpoints
• Download wordlist

Last Finished Scan: